FirstMark

Last week I got the chance to feature in Decibel Partners' Game Day alongside Zack Allen and Jack Naglieri. This 'ESPN-style' panel was fun and at times got a little spicy. Some key takeaways: Federated search is valuable but a feature, not an industry (hence why we built it, and why data gravity is real but doesn't decide whether you find the thing). Indicator shelf life is collapsing: artifacts rotate freely and cheaply now, so we focus more on TTPs/behavior and less on the threat actor themselves (why I started this company 2+ years ago). AI-SOC commoditization: agentic alert triage adds value, but triage with no context underneath it hits a ceiling fast. More on our federated search feature in comments. Stay secure and stay curious, my friends!

The SIEM debate has two camps and both are wrong: centralize everything into a shiny new lake and put an agent on top of it; or centralize nothing and federate every query out to wherever the data happens to live. Both are answering the same question: "where do I put my data so I can query it later?" That reactive-by-default posture puts defenders on the back foot before anything has even happened. So we started from data gravity instead. Some of your data generates signal, and that data earns its place close to you. Behavior is that data… endpoint, identity, cloud. It's what we reason over, what we hunt backward through, what our models learn from, so we keep it where we control it. Everything else is context you only want at the moment you're asking for it, and there's far more of that sitting in tools you already run than you would ever pay to store. So Nebulock Helix goes and gets it. Our agents hit the source directly, translate the question into whatever that tool speaks, and fold the answer straight into your hunts, investigations and findings. Nothing pre-ingested, nothing stored, precisely zero ingest tax. You connect by API and you're hunting in minutes instead of standing up a pipeline for weeks. When a hunt reaches for something, it pulls the live state of that source, not a copy you shipped in last week (fingers crossed it's up to date), and you never hit the moment mid-hunt where you realize you kept nothing to hunt through. Live today across Qualys, Tenable, Rapid7, Axonius, CrowdStrike, and Microsoft Defender, with plenty more dropping in the coming weeks. You don't have to store the evidence, or pay to keep it. You just have to know when to go get it. More about this release (s/o Ian McShane's blog) in comments.

FirstMark teamed up with Chelsea Commons to host a sushi-making class for undergrad researchers, engineers, and operators from Jane Street, Two Sigma, Ramp, Microsoft, and more. To call this bunch impressive would be the understatement of the century. Truly in awe of what they're already working on. We can't wait for the next one! Big thanks to Rho for sponsoring.

Enjoyed New York views from 90 floors up with a group of talented engineers & builders from University of Waterloo! Thank you Emma Xing & Techyon for bringing a great circle together on this adventure. 🪩 Some of our dispo photos below (some excellent photographers in the crowd).

We had a blast hosting the FirstMark's MAD rooftop party at our NYC office last week with Matt Turck. Even though the weather pushed us indoors, the space was packed with incredible conversations and connections across New York’s developer and builder ecosystem. 👾 Between the great discussions and the magician blowing everyone's minds, it was an unforgettable night. 🪄 TYSM to our amazing planning team: Leah Levine, Faith Waldron, Samantha Tuozzolo, Isis Welch, M.S., Yashih W., Terri Kim. #NYTech #Datadog #FirstMark #Developers #AI

My heart is full, my sinuses are bone dry, and despite being an East Coaster now, I am thoroughly sick of air conditioning. Here’s Vegas by the numbers: 24,000: my average steps a day 103 degrees: peak temp outside that I ran in (don’t do this) Dozens of customer meetings (scheduled and unscheduled)  Two sponsored happy hours (thank you VulnCheck, and thank you Zack Allen) and two podcast recordings  One Decibel Game Day discussion on the future of SIEM …and One Backstreet Boys concert, which I will not be defending Plus Nebulock's first-ever Black Hat booth, tirelessly worked by a team that somehow made it three days. I’m so proud of what our team has accomplished, and it’s incredibly rewarding to hear how we’re solving these problems for our customers, the pull from prospects, and how hunt-first security operations is really starting to resonate. Thank you to those pitctured and not pictured for making our debut Black Hat a roaring success. Time to get back to building…and back to Vegas at the end of the month for Fal.Con, because apparently one desert trip a summer is no longer the plan.